CVE-2023-48714: Restricted Record Titles Exposure in silverstripe/framework

Background

silverstripe/framework is a PHP framework used for building websites and web applications. It provides a range of features and functionalities to developers, including a GridField component for managing and displaying data in a tabular format. This vulnerability affects versions 0.0.0 to 4.13.39 and 5.0.0 to 5.1.11 of the framework. The vulnerability allows users to view the titles of restricted records if they are exposed by the GridFieldAddExistingAutocompleter component.

Vulnerability Detail

The vulnerability arises when a user who should not have access to a particular record is able to add it to a GridField using the GridFieldAddExistingAutocompleter component. In such cases, the user can access the title of the restricted record, even though they should not have visibility into its content. This can potentially lead to unauthorized access to sensitive information. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.

Workaround

As a temporary workaround, developers can modify the GridFieldAddExistingAutocompleter component to enforce stricter access controls. This can be achieved by customizing the component's code to check the user's permissions before allowing the addition of a record to the GridField. By explicitly denying access to restricted records, the workaround prevents their titles from being exposed. Here is an example of how the code modification can be implemented:

// Customized GridFieldAddExistingAutocompleter component
class CustomGridFieldAddExistingAutocompleter extends GridFieldAddExistingAutocompleter {
    protected function getSearchList(GridField $gridField, $searchCriteria) {
        $list = parent::getSearchList($gridField, $searchCriteria);
        // Check user's permissions and exclude restricted records
        $list = $list->exclude('Restricted', true);
        return $list;
    }
}

By using this workaround, the exposure of restricted record titles can be mitigated until the framework is updated.

Conclusion

The vulnerability in silverstripe/framework allows users to view the titles of restricted records if exposed by the GridFieldAddExistingAutocompleter component. To mitigate this issue, it is recommended to upgrade to the latest version of the framework. A temporary workaround is also available by customizing the component's code to enforce stricter access controls. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for silverstripe/framework →

FAQ